Privacy Notice
Last updated October 19, 2026
Who is responsible
Debora Duro operates Food Spy and is the data controller for the personal data described here.
What we collect and why
- Account details (email, sign-in method, password stored securely, account creation date) — to create your account and run your 7-day free trial. Basis: contract.
- Subscription status (plan, status, renewal date, payment provider IDs — never your card number) — to give subscribers access. Basis: contract.
- Label photos you scan or search with — sent to an AI service to read the label, then not kept by us on our servers. Basis: contract.
- Shopping lists — saved so they're there next time. Basis: contract.
- Feedback (rating and your message, no name or email) — to improve the app. Basis: legitimate interests.
- Saved on your device (scan history, favourite recipes, missions) — stays in your browser; we don't receive it.
- Technical data (IP address, device and browser type, error logs) — for security, fraud prevention and fixing problems. Basis: legitimate interests.
Food Spy is meant to be used by parents with their children. We do not knowingly collect personal data from children; accounts are for adults.
Who we share it with
- Paddle, our Merchant of Record, for checkout, subscription management, payments, tax and invoices.
- Service providers for hosting, database, sign-in (including Google if you choose it) and AI label reading.
- Professional advisers (legal, accounting) when needed.
- Authorities where required by law.
Product searches are sent to Open Food Facts and recipe searches to TheMealDB; these contain only your search words.
How long we keep it
We keep account and subscription data while your account is open and as required for tax and accounting, then delete or anonymise it. You can ask us to delete your account at any time.
Your rights
You can ask to access, correct, delete or export your data, object to or restrict certain uses, and withdraw consent where we rely on it. Send your request through the Secret agent feedback form in the app (Parent tab); for payment data, contact Paddle at paddle.net. Depending on where you live (for example California, the UK or the EU) you may also complain to your local data protection authority.
International transfers
Our providers may process data in the United States and other countries, using safeguards such as standard contractual clauses where required.
Security
We use encryption in transit, access controls and restricted database access to protect your data.
Cookies and local storage
We use only essential storage: to keep you signed in and to save your in-app progress on your device. We do not use advertising cookies.